Skip to main content
Site Store Pro exposes dedicated webhook endpoints for Stripe and Paddle. All endpoints are CSRF-exempt and use cryptographic signature verification to reject forged or replayed requests. This page documents the endpoint URLs, registration steps, signature algorithms, handled events, the inventory update webhook, and how to add a custom payment gateway.

​
Overview

Site Store Pro exposes dedicated webhook endpoints for each payment processor. All routes under webhooks/* are CSRF-exempt via a wildcard exclusion in bootstrap/app.php — no token is required for incoming webhook requests.

​
Stripe Webhook

Endpoint: POST /webhooks/stripe

​
Registration

Go to Stripe Dashboard → Developers → Webhooks → Add endpoint and enter:

​
Signature Verification

Verification uses Stripe\Webhook::constructEvent() with the Stripe-Signature header and the secret above. Any request with an invalid or missing signature is rejected with a 400 response.

​
Handled Events

​
Paddle Webhook

Endpoint: POST /webhooks/paddle

​
Registration

Go to Paddle Dashboard → Developer Tools → Notifications → New Destination and enter:

​
Signature Verification

Site Store Pro manually verifies Paddle signatures using the following steps:
  1. Parses the Paddle-Signature header: ts=<timestamp>;h1=<hex>
  2. Computes HMAC-SHA256(key=PADDLE_WEBHOOK_SECRET, data="<ts>:<raw_payload>")
  3. Compares the computed hash against the h1 value in the header
  4. Rejects any event with a timestamp older than 5 minutes (replay attack protection)

​
Handled Events

​
Gateway Customer ID Columns

When customer.created events are received, Site Store Pro automatically persists the gateway customer identifier to the users table. These IDs are used for future subscription renewals and to link subsequent webhook events back to a Site Store Pro user.

​
Inventory Update Webhook

Endpoint: POST /webhooks/inventory-update Use this endpoint to push inventory changes from an external warehouse management system (WMS) or ERP into Site Store Pro without requiring admin panel access.

​
Request Body

​
Responses

Secure this endpoint by restricting access at the network level (firewall/IP allowlist) or by adding a shared-secret header check in the extension override for your integration.

​
Adding a Custom Gateway

1

Copy the example gateway

2

Implement your processor class

Rename and implement MyGatewayProcessor.php. Your class must implement PaymentProcessorInterface.
3

Add credentials to .env

4

Insert a row into order_processors

Add a record with a processor_id of 100 or higher. IDs 0–99 are reserved for built-in processors.
5

Register in config/payment_processors.php

6

Register your gateway's JS type

Add a case for your processor ID that returns your gateway’s JS type string. This string is used to select the correct client-side SDK at checkout.
7

Set as active in Admin

Go to Admin → Checkout → Processors and set your custom gateway as the Primary processor.
The payment-processors/ directory is outside app/ by design. Its contents are never overwritten by platform updates, so your custom gateway code is safe across upgrades.

Stripe Configuration

Full Stripe setup including API keys and extension override.

Paddle Configuration

Full Paddle setup including Price IDs and dynamic pricing fallback.

Subscriptions

Subscription lifecycle webhooks and entitlement handling.

Payment Overview

Processor architecture, randomize mode, and the two-step checkout flow.